e4d7e0cfd62d56a90e1b81e716003b35fd129f86717837699e8d8b28b70c6f12

Analysis

user interaction
yes
max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RedGiant Activation Service Unlocker 2026.1.0.exe
Size 8.9MB
Sample261023-dmbknabx3m
SHA256 e4d7e0cfd62d56a90e1b81e716003b35fd129f86717837699e8d8b28b70c6f12
MD5 d589282dce3b40e1fd31596ae6515e6a
SHA1 f7b8ce7b9a2e0fb68e2dbd1a5a36ce9445125c89
SHA512 a13252525f86166422ed671cb6fa262228f25c3fa292f63cf470d0f51bb683f730aa1541430a7593a8e2db4a230bd8517a2488754247a54d083f26903b6b3499
SSDEEP 196608:+72TEwEZnTgG42WHFQgbe31KaB262vo98OOqLw50jkghl:G20nTrRWlQmeAq2Y8Zmwmxhl
TLSH
T10796222AB29E653DD06A5A3545B3C2209A3B7E25B4338D1F86F4394CCF324445E3F6B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution installer persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	deep.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable = "1"	deep.tmp

Executes dropped EXE 25 IoCs

pid	Process
5864	RedGiant Activation Service Unlocker 2026.1.0.tmp
2704	deep.exe
3592	deep.tmp
2260	perl.exe
2988	perl.exe
5600	perl.exe
5852	perl.exe
1480	perl.exe
3116	perl.exe
3752	perl.exe
5404	perl.exe
5080	perl.exe
4584	perl.exe
5744	perl.exe
4820	perl.exe
2964	perl.exe
584	perl.exe
1680	perl.exe
1340	perl.exe
1880	perl.exe
3400	perl.exe
4120	perl.exe
936	perl.exe
2284	perl.exe
728	perl.exe

Loads dropped DLL 64 IoCs

pid	Process
2260	perl.exe
2260	perl.exe
2260	perl.exe
2260	perl.exe
2988	perl.exe
2988	perl.exe
2988	perl.exe
2988	perl.exe
5600	perl.exe
5600	perl.exe
5600	perl.exe
5600	perl.exe
5852	perl.exe
5852	perl.exe
5852	perl.exe
5852	perl.exe
1480	perl.exe
1480	perl.exe
1480	perl.exe
1480	perl.exe
3116	perl.exe
3116	perl.exe
3116	perl.exe
3116	perl.exe
3752	perl.exe
3752	perl.exe
3752	perl.exe
3752	perl.exe
5404	perl.exe
5404	perl.exe
5404	perl.exe
5404	perl.exe
5080	perl.exe
5080	perl.exe
5080	perl.exe
5080	perl.exe
4584	perl.exe
4584	perl.exe
4584	perl.exe
4584	perl.exe
5744	perl.exe
5744	perl.exe
5744	perl.exe
5744	perl.exe
4820	perl.exe
4820	perl.exe
4820	perl.exe
4820	perl.exe
2964	perl.exe
2964	perl.exe
2964	perl.exe
2964	perl.exe
584	perl.exe
584	perl.exe
584	perl.exe
584	perl.exe
1680	perl.exe
1680	perl.exe
1680	perl.exe
1680	perl.exe
1340	perl.exe
1340	perl.exe
1340	perl.exe
1340	perl.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Red Giant\Services\Red Giant Service.exe	deep.tmp
File created	C:\Program Files\Red Giant\Services\is-PCJ6N.tmp	deep.tmp

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3312	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RedGiant Activation Service Unlocker 2026.1.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RedGiant Activation Service Unlocker 2026.1.0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	deep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	deep.tmp

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5800-0-0x0000000000400000-0x00000000004EC000-memory.dmp	innosetup
behavioral2/memory/5800-8-0x0000000000400000-0x00000000004EC000-memory.dmp	innosetup
behavioral2/files/0x000d00000001c562-33.dat	innosetup
behavioral2/memory/2704-36-0x0000000000400000-0x00000000004EC000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
3800	timeout.exe
6056	timeout.exe
4700	timeout.exe

Kills process with taskkill 9 IoCs

defense_evasion

pid	Process
2792	taskkill.exe
1920	taskkill.exe
3204	taskkill.exe
5512	taskkill.exe
3384	taskkill.exe
1852	taskkill.exe
4268	taskkill.exe
4976	taskkill.exe
1108	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5864	RedGiant Activation Service Unlocker 2026.1.0.tmp
5864	RedGiant Activation Service Unlocker 2026.1.0.tmp
3592	deep.tmp
3592	deep.tmp
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	taskkill.exe
Token: SeDebugPrivilege	1920	taskkill.exe
Token: SeDebugPrivilege	3204	taskkill.exe
Token: SeDebugPrivilege	5512	taskkill.exe
Token: SeDebugPrivilege	3384	taskkill.exe
Token: SeDebugPrivilege	1852	taskkill.exe
Token: SeDebugPrivilege	4268	taskkill.exe
Token: SeDebugPrivilege	4976	taskkill.exe
Token: SeDebugPrivilege	1108	taskkill.exe
Token: SeDebugPrivilege	5704	taskmgr.exe
Token: SeSystemProfilePrivilege	5704	taskmgr.exe
Token: SeCreateGlobalPrivilege	5704	taskmgr.exe
Token: 33	5704	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5704	taskmgr.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
5864	RedGiant Activation Service Unlocker 2026.1.0.tmp
3592	deep.tmp
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe
5704	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5704	taskmgr.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 5864	5800	RedGiant Activation Service Unlocker 2026.1.0.exe	89
PID 5864 wrote to memory of 2960	5864	RedGiant Activation Service Unlocker 2026.1.0.tmp	90
PID 2960 wrote to memory of 4188	2960	net.exe	92
PID 5864 wrote to memory of 5008	5864	RedGiant Activation Service Unlocker 2026.1.0.tmp	93
PID 5008 wrote to memory of 4804	5008	net.exe	95
PID 5864 wrote to memory of 3800	5864	RedGiant Activation Service Unlocker 2026.1.0.tmp	96
PID 5864 wrote to memory of 4276	5864	RedGiant Activation Service Unlocker 2026.1.0.tmp	98
PID 4276 wrote to memory of 4280	4276	net.exe	100
PID 5864 wrote to memory of 6056	5864	RedGiant Activation Service Unlocker 2026.1.0.tmp	101
PID 5864 wrote to memory of 6120	5864	RedGiant Activation Service Unlocker 2026.1.0.tmp	103
PID 6120 wrote to memory of 256	6120	net.exe	105
PID 5864 wrote to memory of 2792	5864	RedGiant Activation Service Unlocker 2026.1.0.tmp	106
PID 5864 wrote to memory of 1920	5864	RedGiant Activation Service Unlocker 2026.1.0.tmp	109
PID 5864 wrote to memory of 3204	5864	RedGiant Activation Service Unlocker 2026.1.0.tmp	111
PID 5864 wrote to memory of 5512	5864	RedGiant Activation Service Unlocker 2026.1.0.tmp	113
PID 5864 wrote to memory of 3384	5864	RedGiant Activation Service Unlocker 2026.1.0.tmp	115
PID 5864 wrote to memory of 1852	5864	RedGiant Activation Service Unlocker 2026.1.0.tmp	117
PID 5864 wrote to memory of 4268	5864	RedGiant Activation Service Unlocker 2026.1.0.tmp	119
PID 5864 wrote to memory of 4976	5864	RedGiant Activation Service Unlocker 2026.1.0.tmp	121
PID 5864 wrote to memory of 2704	5864	RedGiant Activation Service Unlocker 2026.1.0.tmp	123
PID 2704 wrote to memory of 3592	2704	deep.exe	124
PID 3592 wrote to memory of 1108	3592	deep.tmp	125
PID 3592 wrote to memory of 3312	3592	deep.tmp	127
PID 3312 wrote to memory of 2260	3312	cmd.exe	129
PID 3312 wrote to memory of 2988	3312	cmd.exe	130
PID 3312 wrote to memory of 5600	3312	cmd.exe	131
PID 3312 wrote to memory of 5852	3312	cmd.exe	132
PID 3312 wrote to memory of 1480	3312	cmd.exe	133
PID 3312 wrote to memory of 3116	3312	cmd.exe	134
PID 3312 wrote to memory of 3752	3312	cmd.exe	135
PID 3312 wrote to memory of 5404	3312	cmd.exe	136
PID 3312 wrote to memory of 5080	3312	cmd.exe	137
PID 3312 wrote to memory of 4584	3312	cmd.exe	138
PID 3312 wrote to memory of 5744	3312	cmd.exe	139
PID 3312 wrote to memory of 4820	3312	cmd.exe	140
PID 3312 wrote to memory of 2964	3312	cmd.exe	141
PID 3312 wrote to memory of 584	3312	cmd.exe	142
PID 3312 wrote to memory of 1680	3312	cmd.exe	143
PID 3312 wrote to memory of 1340	3312	cmd.exe	144
PID 3312 wrote to memory of 1880	3312	cmd.exe	145
PID 3312 wrote to memory of 3400	3312	cmd.exe	146
PID 3312 wrote to memory of 4120	3312	cmd.exe	147
PID 3312 wrote to memory of 936	3312	cmd.exe	148
PID 3312 wrote to memory of 2284	3312	cmd.exe	149
PID 3312 wrote to memory of 728	3312	cmd.exe	150
PID 5864 wrote to memory of 4488	5864	RedGiant Activation Service Unlocker 2026.1.0.tmp	151
PID 4488 wrote to memory of 4628	4488	net.exe	153
PID 5864 wrote to memory of 4700	5864	RedGiant Activation Service Unlocker 2026.1.0.tmp	154

C:\Users\Admin\AppData\Local\Temp\RedGiant Activation Service Unlocker 2026.1.0.exe
"C:\Users\Admin\AppData\Local\Temp\RedGiant Activation Service Unlocker 2026.1.0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Users\Admin\AppData\Local\Temp\is-CC87Q.tmp\RedGiant Activation Service Unlocker 2026.1.0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-CC87Q.tmp\RedGiant Activation Service Unlocker 2026.1.0.tmp" /SL5="$60216,8165999,908800,C:\Users\Admin\AppData\Local\Temp\RedGiant Activation Service Unlocker 2026.1.0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop "Red Giant Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Red Giant Service"
      4⤵
      PID:4188
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop "mxredirect"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "mxredirect"
      4⤵
      PID:4804
- - C:\Windows\system32\timeout.exe
    "timeout" /T 1 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:3800
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop "RLM-Redshift"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "RLM-Redshift"
      4⤵
      PID:4280
- - C:\Windows\system32\timeout.exe
    "timeout" /T 1 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:6056
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" stop mxredirect
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6120
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mxredirect
      4⤵
      PID:256
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "RGContentService.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "MxNotify.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1920
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "maxon.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3204
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "c4dpy.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5512
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "Commandline.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "Cinema 4D Team Render Client.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "Cinema 4D Team Render Server.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4268
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im "Cinema 4D.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- - C:\Users\Admin\AppData\Local\Temp\is-3GUOQ.tmp\deep.exe
    "C:\Users\Admin\AppData\Local\Temp\is-3GUOQ.tmp\deep.exe" /verysilent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\is-5SVM9.tmp\deep.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-5SVM9.tmp\deep.tmp" /SL5="$110244,5166549,908800,C:\Users\Admin\AppData\Local\Temp\is-3GUOQ.tmp\deep.exe" /verysilent
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3592
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /im maxon.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1108
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-IJCMH.tmp\unlocker.cmd""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Magic Bullet Bez Friend\ParamCurve.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Magic Bullet Colorista\Colorista-IV.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Maxon Studio\MaxonStudioAE.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\MBLooks\Looks3_64.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Red Giant Universe\Universe_Glow_Glow_AE_Fx.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Red Giant Universe\Universe_Utilities_Unmult_Premium_AE_Fx.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Red Giant VFX\OpticalGlow.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Red Giant VFX\Primatte Keyer6.AEX"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Common\Plug-ins\7.0\MediaCore\Trapcode\Shine.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Red Giant\Universe\OFX\Universe_Glow_Glow_OFX.ofx.bundle\Contents\Win64\Universe_Glow_Glow_OFX.ofx"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Red Giant\Universe\OFX\Universe_Utilities_Unmult_Premium_OFX.ofx.bundle\Contents\Win64\Universe_Utilities_Unmult_Premium_OFX.ofx"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Adobe After Effects 2026\Support Files\Plug-ins\Trapcode\Particular.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Adobe After Effects 2025\Support Files\Plug-ins\Trapcode\Particular.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Adobe After Effects 2024\Support Files\Plug-ins\Trapcode\Particular.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:584
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Adobe After Effects 2023\Support Files\Plug-ins\Trapcode\Particular.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "cc:\Program Files\Adobe\Adobe After Effects 2022\Support Files\Plug-ins\Trapcode\Particular.aex"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Adobe\Adobe After Effects 2021\Support Files\Plug-ins\Trapcode\Particular.aex"
        6⤵
        Executes dropped EXE
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Red Giant\Plugins\OFX\OpticalGlow.ofx.bundle\Contents\Win64\OpticalGlow.ofx"
        6⤵
        Executes dropped EXE
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Red Giant\Plugins\OFX\Starglow.ofx.bundle\Contents\Win64\Starglow.ofx"
        6⤵
        Executes dropped EXE
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Red Giant\Plugins\OFX\Shine.ofx.bundle\Contents\Win64\Shine.OFX"
        6⤵
        Executes dropped EXE
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xE8..../\xC7\x40\x58\xDC\xFF\xFF\xFF\x33\xC0\xEB\x6D\x44\x8B\x4C\x24\x68\x45\x33\xC0\x48\x8B\x54\x24\x48\x48\x8B\x4C\x24\x40\xB8\x00\x00\x00\x00/g" "c:\Program Files\Red Giant\Plugins\OFX\MagicBulletLooks.ofx.bundle\Contents\Win64\MagicBulletLooks.ofx"
        6⤵
        Executes dropped EXE
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\perl.exe
        
        C:\Users\Admin\AppData\Local\Temp\perl.exe -0777 -w -pi -e "s/\x6D\x61\x78\x6F\x6E\x2E\x6E\x65\x74\x00/\x6D\x61\x78\x6F\x6E\x2E\x7A\x65\x74\x00/g" "c:\Program Files\Maxon\App Manager\Maxon.exe"
        6⤵
        Executes dropped EXE
        
        PID:728
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" start "Red Giant Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start "Red Giant Service"
      4⤵
      PID:4628
- - C:\Windows\system32\timeout.exe
    "timeout" /T 1 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:4700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1860

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VR.lic

Path C:\ProgramData\Maxon\RLM\VR.lic
Size 2KB
SHA256 65f387220ee8c35de2bbae0a59f4fca20523837a7c8539a7000b54a8ee0beda7
MD5 1dfee818feb442b9514cc5615110a8d9
SHA1 cd61b2975523b650b93e0a491fa8f67c279ce51c
SHA512 d6b978ae88f1df9e754a9b7637246f81c74bf1101b67aaba22a770ee45772130bc8a7605d828e307d9b5d382182d656119dd539fc42da42797a62bc3506fd4cb
TLSH
T1FD5113C47204C2B9795245CB32522908A367B3639BBFB51908FC0ED9AA94D39B75F2E4
MD5 SHA1 SHA512 TLSH

Submit Download

deep.exe

Path C:\Users\Admin\AppData\Local\Temp\is-3GUOQ.tmp\deep.exe
Size 6.0MB
SHA256 95267d0dd5711f12f567df0076d321d9b484b7cf6745c1c59ff9dd1871543dea
MD5 390c87f8edebc8370787da447f6032f0
SHA1 d5663afedff03f8b743c886b429e47c50ad5b476
SHA512 b1501635e04c8b9cb67eef9524faca6b12ae17425aea5f27c3d189b7d59bc12ab93508b69977ba7b1df08112f97b99ad362d339af0684f6a2978cef16db48065
SSDEEP 98304:+7ZgWKDzZKTwlQbwp4wK1a1ns6Se/H2uwXcsq7SmxnBOXojkgI6l:+7GWizUslIwpPhSs2P/W5nZjkghl
TLSH
T19556122AB2AE643DD4695A3145B3C2109A3B7E76B4328D2F86F4390CCF764441F3B7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedGiant Activation Service Unlocker 2026.1.0.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-CC87Q.tmp\RedGiant Activation Service Unlocker 2026.1.0.tmp
Size 3.6MB
SHA256 071f0728c954a50a0d4e97866c3143f0935439a1dec76a403653382716104897
MD5 7ab558a8b81def1f65ebfa62a8e53eb0
SHA1 d1cebd798cda39b971dd7e5107516b58daca4dc4
SHA512 4c9a78e7638a5d942a88395d234a0c43d59969573c7c1f77872ca8c6890c57c6e72656b20ed0de75da2c43b9ad4cf986b4ee2ae46fa180d40c5bf39a6f5e500f
SSDEEP 49152:DrHHFnKA0otwLU/g2SmYXFuaYQ4mQVHYEXQcmpeDxjT/t333j3:DrnwboEuM4mQiEC0DH333T
TLSH
T19F064A13F248A93AD06A3A354637C65499377B626A2ADC176BFC3D4C8F361403E3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unlocker.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-IJCMH.tmp\unlocker.cmd
Size 8KB
SHA256 31452f15616a71b0298db001df08cdfb95120491ab45af98bb95e7b6cbefcc42
MD5 4cc36bcd51ad2b24c2fa73fe4797b8e8
SHA1 1d0f1a99bddb4d328b68871af1f0f43841c7aed5
SHA512 23cabe30cdb5c4fb9c2f785326743d8afd2814719ccd60b1eaacdda3b85be243e94452b04604bda624cd511bf71f608c20e036e97569f179bcec2e2505fd8154
SSDEEP 96:xkMkRxkYkpk0k/kzkQkDgcxxexlxCxLtK4xxh1hth5h94:+VR+RGtMA5Lbn/Tq
TLSH
T1AC0280D28740C9C76099D5C51E217B480C6FE158DBAA138A9B1EE39F4F42B8742EFC9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libgcc_s_seh-1.dll
Size 711KB
SHA256 cb96718f7ef83319472e4ca3fcdf6d002226d3a6ff4d0d64b6e221aba58016a3
MD5 97ba9d2d7090a7d265cefed7fa40b1bf
SHA1 04231941ab6681e445c529d35f91d4a2a80f92ec
SHA512 e0ed771116902e2aae3650fed86f2c07fc164134cbaa4961665d7ba33a8f4ef7c6fdbda93046eaa3832df3882d730487a77a973bee9578caa333c83e894bf601
SSDEEP 6144:sbtQeWsyqCyeYJxCMMAmivzouBFBdyjW11jQ1UYggO0Ukuh7RZ5ztkXy3j9acKiV:beWAJUpg3/1sggO0Ukuh7RZ55k5EV
TLSH
T167F43A847B9DB49BC03002B5569B025B1330A98533D4BB6B7E6D7A38DD933D8CF886D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\libstdc++-6.dll
Size 2.2MB
SHA256 d747bb93d4e936ddd57b6258355a977e210ad308c0f832d3d47fab6f9191c2ce
MD5 b1852a4962ea7185dc353fe6f0ab4553
SHA1 b4335332bfc3033e5465db6eb56b344cbe2270b1
SHA512 e7cfba7553879df5df57275e65509f18069ddd8c3c5c18676a2a326bc91204145ddf6be5013380613257b398734e11c513647e86878ec9525533b772d929d2d5
SSDEEP 49152:pbxE3cqZXY88ZxCx7x+vrHpH4cW5aYThxsYiv3c1QD:XEMqcxCx7x+vyZa/3c1QD
TLSH
T177B55B03D6974D7CC9DBE7B4925B92769A20FC298538BD2E5E9CC7302B12E40972FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dll
Size 85KB
SHA256 8ae45c5928698df7da6780e282bc5053a7b1a87a1cba0a2083aa26c473c3f7f9
MD5 59a112452ceccba063cc85d0513fd0a7
SHA1 f046c7d16606bcd8b1104270cdbba545549ea311
SHA512 40bc9c0966dfa13167c59b14eb0c9e2096a30408c65977dec9e86628183505b877aacf5f444b59ff2dd12d42a6e406c68c276b60a598b501d6ff0ea0a87f9115
SSDEEP 1536:Tb4A1X+bp4B4gepS7k8G9rS6nBPm3YB+ZQF69Z6:T9Obp4GkQ8G9rS6nBPm3YB+ZQFOZ6
TLSH
T15383C237E6B388ACC1DB92B0B7C691F175B6FC100520AA1E134596343F5FDA42FAD989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perl.exe

Path C:\Users\Admin\AppData\Local\Temp\perl.exe
Size 43KB
SHA256 13f689c7c8d93a546ae207e28000a0b163851dd0a148d5d329618ffc7daff554
MD5 98a571d345034f8ff5953714a18b68a1
SHA1 118da15a20c31845d64de6a1bfeeaf1046d16263
SHA512 6daee529e6dea6648bad518cc86c8d0bfd59399908eda24ff622c1cb6f60115fd6a6dc21886a86beefe36e476077101ebbc4c4a9a11af5247c0d7853e67a7fc8
SSDEEP 768:u95VKDDsyfhw1111111111111111111111111111Tb4YMz8vEUDCFFtFF9vQ4:rHsyobCzKIFFtFFK4
TLSH
T17F13D75EF722C899C5C552B4F48986F1D6A0FCF1C850462F22377F697B727884F69282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perl538.dll

Path C:\Users\Admin\AppData\Local\Temp\perl538.dll
Size 3.0MB
SHA256 68bef13493195a03f812c8f6dc15ff1c429010644605e5f9dc66388e77fe2eaf
MD5 a6764a022dc825aba978297546603e0f
SHA1 a8ff5ac32cd4848534b68c95b9df44fdb6f57a25
SHA512 564ba6f9a9e1b12488bf6768af7f8a456730449d82ce88cba17944ea0c52c081117dec57828eb612ac41bba0dcb38ab0c580733f126e057a38023cae29ebffbf
SSDEEP 49152:B+lFF8N8QewIPGm4CKzGNR7OPlTmKZ9kjCr4WmKME0YHAnGlJO12RIT5kqBGV9Px:0lWHzh
TLSH
T141E54A47ECA2D674C46D82754EAF07667332F08C66267B1F25289A303E53B241F9E36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1480-109-0x00007FFE28200000-0x00007FFE282A5000-memory.dmp

Download

memory/1480-108-0x00007FFE21E60000-0x00007FFE2217A000-memory.dmp

Download

memory/1480-111-0x00007FFE2F7A0000-0x00007FFE2F7BD000-memory.dmp

Download

memory/1480-110-0x00007FFE1E7A0000-0x00007FFE1E9D8000-memory.dmp

Download

memory/1480-107-0x00007FF743BD0000-0x00007FF743BE3000-memory.dmp

Download

memory/2260-67-0x00007FFE1E7A0000-0x00007FFE1E9D8000-memory.dmp

Download

memory/2260-66-0x00007FFE2F7A0000-0x00007FFE2F7BD000-memory.dmp

Download

memory/2260-63-0x00007FF743BD0000-0x00007FF743BE3000-memory.dmp

Download

memory/2260-64-0x00007FFE21E60000-0x00007FFE2217A000-memory.dmp

Download

memory/2260-65-0x00007FFE28200000-0x00007FFE282A5000-memory.dmp

Download

memory/2704-36-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/2988-78-0x00007FFE2F7A0000-0x00007FFE2F7BD000-memory.dmp

Download

memory/2988-77-0x00007FFE1E7A0000-0x00007FFE1E9D8000-memory.dmp

Download

memory/2988-75-0x00007FFE21E60000-0x00007FFE2217A000-memory.dmp

Download

memory/2988-76-0x00007FFE28200000-0x00007FFE282A5000-memory.dmp

Download

memory/2988-74-0x00007FF743BD0000-0x00007FF743BE3000-memory.dmp

Download

memory/3116-121-0x00007FFE1E7A0000-0x00007FFE1E9D8000-memory.dmp

Download

memory/3116-118-0x00007FF743BD0000-0x00007FF743BE3000-memory.dmp

Download

memory/3116-122-0x00007FFE2F7A0000-0x00007FFE2F7BD000-memory.dmp

Download

memory/3116-119-0x00007FFE21E60000-0x00007FFE2217A000-memory.dmp

Download

memory/3116-120-0x00007FFE28200000-0x00007FFE282A5000-memory.dmp

Download

memory/3752-133-0x00007FFE2F7A0000-0x00007FFE2F7BD000-memory.dmp

Download

memory/3752-132-0x00007FFE1E7A0000-0x00007FFE1E9D8000-memory.dmp

Download

memory/3752-131-0x00007FFE28200000-0x00007FFE282A5000-memory.dmp

Download

memory/3752-130-0x00007FFE21E60000-0x00007FFE2217A000-memory.dmp

Download

memory/3752-129-0x00007FF743BD0000-0x00007FF743BE3000-memory.dmp

Download

memory/4584-162-0x00007FF743BD0000-0x00007FF743BE3000-memory.dmp

Download

memory/4584-164-0x00007FFE28200000-0x00007FFE282A5000-memory.dmp

Download

memory/4584-163-0x00007FFE21E60000-0x00007FFE2217A000-memory.dmp

Download

memory/4584-166-0x00007FFE2F7A0000-0x00007FFE2F7BD000-memory.dmp

Download

memory/4584-165-0x00007FFE1E7A0000-0x00007FFE1E9D8000-memory.dmp

Download

memory/4820-179-0x00007FF743BD0000-0x00007FF743BE3000-memory.dmp

Download

memory/4820-183-0x00007FFE2F7A0000-0x00007FFE2F7BD000-memory.dmp

Download

memory/4820-180-0x00007FFE21E60000-0x00007FFE2217A000-memory.dmp

Download

memory/4820-181-0x00007FFE28200000-0x00007FFE282A5000-memory.dmp

Download

memory/5080-152-0x00007FFE21E60000-0x00007FFE2217A000-memory.dmp

Download

memory/5080-155-0x00007FFE2F7A0000-0x00007FFE2F7BD000-memory.dmp

Download

memory/5080-153-0x00007FFE28200000-0x00007FFE282A5000-memory.dmp

Download

memory/5080-151-0x00007FF743BD0000-0x00007FF743BE3000-memory.dmp

Download

memory/5080-154-0x00007FFE1E7A0000-0x00007FFE1E9D8000-memory.dmp

Download

memory/5404-141-0x00007FFE21E60000-0x00007FFE2217A000-memory.dmp

Download

memory/5404-144-0x00007FFE2F7A0000-0x00007FFE2F7BD000-memory.dmp

Download

memory/5404-140-0x00007FF743BD0000-0x00007FF743BE3000-memory.dmp

Download

memory/5404-142-0x00007FFE28200000-0x00007FFE282A5000-memory.dmp

Download

memory/5404-143-0x00007FFE1E7A0000-0x00007FFE1E9D8000-memory.dmp

Download

memory/5600-85-0x00007FF743BD0000-0x00007FF743BE3000-memory.dmp

Download

memory/5600-88-0x00007FFE1E7A0000-0x00007FFE1E9D8000-memory.dmp

Download

memory/5600-86-0x00007FFE21E60000-0x00007FFE2217A000-memory.dmp

Download

memory/5600-89-0x00007FFE2F7A0000-0x00007FFE2F7BD000-memory.dmp

Download

memory/5600-87-0x00007FFE28200000-0x00007FFE282A5000-memory.dmp

Download

memory/5744-175-0x00007FFE28200000-0x00007FFE282A5000-memory.dmp

Download

memory/5744-174-0x00007FFE21E60000-0x00007FFE2217A000-memory.dmp

Download

memory/5744-177-0x00007FFE2F7A0000-0x00007FFE2F7BD000-memory.dmp

Download

memory/5744-173-0x00007FF743BD0000-0x00007FF743BE3000-memory.dmp

Download

memory/5744-176-0x00007FFE1E7A0000-0x00007FFE1E9D8000-memory.dmp

Download

memory/5800-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/5800-8-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/5852-97-0x00007FFE21E60000-0x00007FFE2217A000-memory.dmp

Download

memory/5852-100-0x00007FFE2F7A0000-0x00007FFE2F7BD000-memory.dmp

Download

memory/5852-96-0x00007FF743BD0000-0x00007FF743BE3000-memory.dmp

Download

memory/5852-98-0x00007FFE28200000-0x00007FFE282A5000-memory.dmp

Download

memory/5852-99-0x00007FFE1E7A0000-0x00007FFE1E9D8000-memory.dmp

Download

memory/5864-9-0x0000000000400000-0x00000000007A1000-memory.dmp

Download

memory/5864-52-0x0000000000400000-0x00000000007A1000-memory.dmp

Download

memory/5864-10-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Download

memory/5864-6-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Download